A network security threat detection method and system based on trusted service flow

Abstract

The invention discloses a method and a system for detecting a network security threat based on trusted business flow. The method comprises the following steps of establishing a blacklist and a white list of network flow and constructing a baseline model, wherein the white list is the trusted business flow and is a feature contour library of normal network behavior and host behavior; comparing real-time monitoring flow data and the baseline model; when the real-time data is matched with the blacklist, outputting an abnormal flow alarm; when the real-time data is matched with the white list and a deviation exceeds a preset threshold, outputting a threat flow alarm; and when the real-time data is mismatched with the blacklist and the white list, treating as a gray list and outputting an unknown flow alarm. According to the method and the system, the network security threat can be comprehensively and effectively detected at a low false alarm rate and high anti-virus efficiency, and the method and the system can adapt to a more granular network attack and defense confrontation environment.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a network security threat detection method and system based on trusted service flow. Background technique [0002] The software and hardware design of the currently deployed firewalls were only considered based on their working conditions at L2-L4, and they did not have the ability to comprehensively and in-depth monitor data flows. Naturally, they could not effectively identify illegal traffic masquerading as normal services. , Attacks, spyware, point-to-point applications and other illegal traffic can easily enter and exit the network through the ports opened by the firewall. This is why users still suffer from intrusions, worms, viruses, and denial-of-service attacks after deploying a firewall. In fact, the worm can penetrate the firewall and spread rapidly, causing the host to be paralyzed, devouring valuable network bandwidth, P2P and other applications...

AI Technical Summary

Problems solved by technology

[0008] The purpose of the present invention is to provide a network security threat detection method and system based on trusted service flow, so that it can comprehensively and effectively detect network security threats, with low false alarm rate, high anti-killing efficiency, and adapts to more fine-grained Network attack and defense confrontation environment, so as to overcome the deficiencies of the existing defense system, such as high false alarm rate, low efficiency, and many loopholes

Images