Network inbreak event association detecting method

Abstract

The invention relates to a correlative detecting method of network intrusion events, which pertains to the network security technical field. In the correlative detecting method of the invention, an intrusion detecting system reports the intrusion warning information and stores all warning informations respectively into four database tables. Beginning from the attack of the fourth database table, each warning item in the fourth database table is searched and matched previous hacker attack behavior in the third database table which stores backdoor; if the searching and matching are successful, new searching and matching are carried out; the warning items in the third database table are searched and matched in the second database table which stores promotion authority; the process is analogized until warning items in the first database table are matched, and the results concerning successful matching are stored into the event database table after being associated; beginning from the fourth database table when all warning items are finished, the searching and matching are carried out from the third database table, the process is analogized till the first database table are matched. The correlative detecting method of the invention reduces false warning rate of intrusion event detecting system and improves the accuracy rate of reporting security event.

Description

technical field [0001] The invention relates to a detection method in the technical field of network security, in particular to a network intrusion event correlation detection method. Background technique [0002] With the rapid development of computer networks, the security of information and networks has become an unavoidable problem for countries, enterprises and individuals. As a solution to network security problems, the intrusion detection system has become a new generation of security protection technology after traditional security protection measures such as firewalls and data encryption because it has the characteristics of actively monitoring the network / system to find intrusion behavior. Intrusion detection systems based on misuse usually cannot detect new types of attacks and variant attacks of known attacks, while the false alarm rate of intrusion detection systems based on anomalies is too high. And more importantly, the current intrusion detection system onl...

AI Technical Summary

Problems solved by technology

The disadvantage of this method is that the matching efficiency of alarm information is very low, the main reason is that the intruder often has to carry out a certain attack hundreds or thousands of times before he may succeed once or twice before proceeding to the next attack.

[0005]This front-to-back matching method is theoretically feasible, but in an actual system, it will consume a lot of system resources and time for search and matching, which is inefficient

Images