Method, system and device for intrusion detection

Abstract

The invention discloses a method, a system and a device for intrusion detection. The method comprises the following steps: acquiring (201) abnormal behavior characteristics of a message; extracting (202) primary abnormal intrusion regulations according to the abnormal behavior characteristics; searching (203) a subsequently received message in a matching way according to the primary abnormal intrusion regulations; considering (205) that intrusion behaviors exist if the subsequently received message is matched to be searched. The embodiment of the invention shortens the detection response time of abnormal intrusion and enhances the intrusion discovery rate and the adaptive capacity of the abnormal intrusion behaviors.

Description

technical field [0001] The invention relates to the technical field of computer networks, in particular to an intrusion detection method, system and device. Background technique [0002] As more and more important information is stored in the computer and network system, the security problem of the system is becoming more and more prominent, and it is necessary to find better measures to protect the system from the intruder's attack. IDS (Intrusion Detection System, Intrusion Detection System) is another very important security technology after traditional security protection measures such as "firewall" and "data encryption". [0003] IDS can be divided into misuse detection system and anomaly detection system. The misuse detection system pre-establishes the intrusion feature pattern library for known system and application software vulnerabilities, and performs pattern matching between the received information and the intrusion features to determine whether an intrusion ha...

AI Technical Summary

Problems solved by technology

[0005] In the existing technology, the intrusion behaviors show the characteristics of uncertainty, complexity and diversity, and the intrusion detection system can only detect the new intrusion behaviors after obtaining the corresponding new intrusion rules sent by the system.

Therefore, in the absence of the corresponding new intrusion rules, new intrusion behaviors cannot be discovered, which leads to a long response time for the client to detect abnormal intrusions, a low intrusion discovery rate, and poor adaptability to mutated intrusion behaviors.

Images