Security detection method and system based on attack association

Abstract

The invention discloses a security detection method and system based on attack association. The method includes the steps of detecting whether input flow has attack behaviors or not, extracting information of the input flow with the attack behaviors, storing the information in an attack source set, conducting different types of analysis on log records according to the detection result through the combination with the attack source, finding out all the attack behaviors of the input flow, and finding attack behaviors possibly hidden in the input flow. The association between the input flow and the log records is analyzed, and therefore all the attack behaviors and the hidden attack behaviors of the input flow are conveniently and efficiency mined, and the network management can be more efficiency and reliable.

Description

technical field [0001] The invention relates to a detection and protection system in the field of network security, in particular to an attack correlation-based security detection method and system. Background technique [0002] With the increasing awareness of network security, more and more enterprises are protecting against attacks by purchasing security devices such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). When hackers conduct infiltration attacks on enterprises, they are usually intercepted by security devices in the enterprise network. By auditing the log records in the devices, administrators can clearly see the attacker's IP, attack time, attack target and other information. This greatly simplifies the work of network administrators. [0003] However, although most of the existing security products realize real-time traffic attack detection and interception, they do not correlate and analyze historical events or real-t...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is that if an attacker in the prior art has broken through the network security device before the security device is put on the shelf, it is impossible to know its penetration behavior on the intranet, and when the attacker attacks an enterprise network with a lot of business , it is very difficult to troubleshoot and cannot effectively intercept the hidden attack behavior. A security detection method and system based on attack correlation is provided.

Images