Method and system for detecting network security threat based on trusted business flow

Abstract

The invention discloses a method and a system for detecting a network security threat based on trusted business flow. The method comprises the following steps of establishing a blacklist and a white list of network flow and constructing a baseline model, wherein the white list is the trusted business flow and is a feature contour library of normal network behavior and host behavior; comparing real-time monitoring flow data and the baseline model; when the real-time data is matched with the blacklist, outputting an abnormal flow alarm; when the real-time data is matched with the white list and a deviation exceeds a preset threshold, outputting a threat flow alarm; and when the real-time data is mismatched with the blacklist and the white list, treating as a gray list and outputting an unknown flow alarm. According to the method and the system, the network security threat can be comprehensively and effectively detected at a low false alarm rate and high anti-virus efficiency, and the method and the system can adapt to a more granular network attack and defense confrontation environment.

Description

Technical field [0001] The invention relates to the technical field of network information security, in particular to a method and system for detecting network security threats based on trusted service flow. Background technique [0002] The software and hardware design of the currently deployed firewall was only considered based on the situation when it was working at L2-L4, and did not have the ability to comprehensively and in-depth monitor the data flow. Naturally, it was unable to effectively identify the illegal traffic disguised as normal business. As a result, the worm Illegal traffic such as, attacks, spyware, and point-to-point applications can easily enter and exit the network through the open ports of the firewall. This is why users are still plagued by intrusions, worms, viruses, and denial of service attacks after the firewall is deployed. In fact, worms can penetrate firewalls and spread quickly, causing host failures, swallowing valuable network bandwidth, P2P an...

AI Technical Summary

Problems solved by technology

[0008] The purpose of the present invention is to provide a network security threat detection method and system based on trusted service flow, so that it can comprehensively and effectively detect network security threats, with low false alarm rate, high anti-killing efficiency, and adapts to more fine-grained Network attack and defense confrontation environment, so as to overcome the deficiencies of the existing defense system, such as high false alarm rate, low efficiency, and many loopholes

Images