A host-based network attack springboard detection method and device

Abstract

The invention relates to the field of multistage network springboard host detection, in particular to a network attack springboard detection method. For solving existing technical problems, a network attack springboard detection method and device based on a host are provided. Tracing is conducted to find out an attacker, it is necessary that the network attack springboard host can be detected, therefore, network attacks conducted through the springboard host can be restrained, and the attacker hidden behind the springboard host is found out step by step. In the network attack springboard detection method and device based on the host, a data packet capturing module captures data packets of the host, a data stream recognition and analysis module receives the data packets captured by the data packet capturing module, a springboard detection module detects whether data stream groups meet detection requirements or not, if the data stream groups meet the detection requirements, detection is conducted, the springboard detection module conducts data matching on the data stream groups and calculates an Echo_RTT value and an Ack_RTT value, the relationship value between the Echo_RTT and the Ack_RTT is judged, and the springboard credibility rating is determined.

Description

technical field [0001] The invention relates to the field of multi-level network springboard host detection, in particular to a network attack springboard detection method and device. Background technique [0002] At present, network attacks are becoming more and more rampant, and the attack methods are becoming more and more complex. Attackers usually use multi-level springboard hosts to implement attack steps when carrying out network attacks, so as to achieve the purpose of hiding the identity of the attacker. The springboard host refers to the host that the attacker attacks and controls in advance. The attacker logs in to multiple springboard hosts step by step to form a springboard attack chain, and implements specific network attacks through the last springboard host, such as figure 1 mentioned. Since the victim can only trace the last springboard host, the attacker can use the springboard attack chain to evade tracking and hide his identity. Most of the springboard ...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is: Aiming at the problem that network attackers in the prior art usually use multi-level springboard hosts to implement the attack steps when carrying out network attacks, so as to achieve the purpose of concealing the identity of the attacker, the solution is to trace the identity of the attacker through the network To trace the source and find the attacker, it is necessary to be able to detect the springboard host of the network attack, so as to curb the network attack through the springboard host and find the attacker hidden behind the springboard host step by step

Images