Network attack detection method and device

Abstract

The invention provides a network attack detection method and device. The method includes the steps that behavior characteristic parameters of a preset user and the number of intrusion prevention alarming times of the preset user are obtained in a preset period of time; the deviation degree of the preset user and each standard user is calculated according to behavior characteristic parameters of each standard user in a pre-built standard user model and the behavior characteristic parameters of the preset user, the pre-built standard user model corresponds to the preset user, and the deviation degree is used for representing the similarity of the behavior characteristic parameters of two users; the minimum deviation degree in the deviation degrees of the preset user and the standard users is determined; according to a weighted summation result of the number of intrusion prevention alarming times and the minimum deviation degree, network attack warning is generated for the preset user. The method and device can reduce the number of warning times and improve the effective rate of warning.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network attack detection method and device. Background technique [0002] With the rapid expansion of network scale, network security issues become more and more severe, and various attacks on the network emerge in an endless stream, so network attack detection technology is becoming more and more important. [0003] A commonly used network attack detection method is: when it is determined that a network attack occurs, the attack message, attack character string and other characteristics during the attack process are determined as attack signatures and stored. When any attack signature is detected, an alarm is generated to prompt the operation and maintenance personnel that the network is in danger. [0004] This network attack detection method will generate an alarm every time an attack signature is detected, and a large number of attack signatures may be detected du...

AI Technical Summary

Problems solved by technology

[0005] The present invention provides a method and device for network attack detection, which are used to solve the problem that existing network attack detection schemes in the prior art affect the effectiveness of alarms and cause a high probability of missed detection or false detection.

Images