Network intrusion detection method and system

Abstract

The invention provides a network intrusion detection method and system. The network intrusion detection method comprises the following steps that access data within a preset time period are obtained; access data feature information is extracted from the access data; whether suspicious access exists or not is judged according to the access parameter feature information. According to the network intrusion detection method and system, a remote program adopting the HTTP tunnel penetrating technology can be efficiently detected out, and the system safety can be improved; in addition, the network intrusion detection system does not need to be additionally arranged behind a firewall, and therefore system cost is reduced.

Description

technical field [0001] The invention belongs to the field of network communication, in particular to a network intrusion detection method and system. Background technique [0002] The Trojan horse remote control program uses the HTTP tunnel penetration technology to disguise the private communication protocol in the HTTP protocol. At the same time, due to business needs, most firewalls allow HTTP data packets to pass through, which will cause the data packets of the Trojan horse remote control program to go smoothly. Through the firewall, it threatens the security of the intranet. [0003] When the firewall fails, in most cases the intranet is directly exposed; some stronger protection systems also have an intrusion detection system behind the firewall, but the intrusion detection system is expensive, which will virtually increase the cost and burden of the enterprise. The emergence of HTTP tunneling technology has brought great threats to the internal network security of e...

AI Technical Summary

Problems solved by technology

[0002] The Trojan horse remote control program uses the HTTP tunnel penetration technology to disguise the private communication protocol in the HTTP protocol. At the same time, due to business needs, most firewalls allow HTTP data packets to pass through, which will cause the data packets of the Trojan horse remote control program to go smoothly. Threat to the security of the intranet through the firewall

[0003] When the firewall fails, in most cases the intranet is directly exposed; some stronger protection systems will also have an intrusion detection system behind the firewall, but the intrusion detection system is expensive, which will virtually increase the cost and burden of the enterprise

Images