Behavior characteristics-based network attack detection method and device

Abstract

The invention discloses a behavior characteristics-based network attack detection method and device, and relates to the technical field of information security. The technical points of the method comprise the following steps: step 1, collecting original security information output by various types of security equipment, and converting all security information into security events with the unified format; step 2, classifying all security events according to each field content; and step 3, sequencing all security events which have the same source IP address and the same destination IP address and occur within one monitoring period according to the sequence of event generation time to obtain security event combinations, and searching whether the same security event combination is stored in a security event correlation rule library or not, if yes, determining that a host corresponding to the destination IP address suffers from attacking and warning, or if not, storing all security events in an association rule mining database.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a network attack detection method based on behavior characteristics. Background technique [0002] In the rapid popularization of the Internet, while people feel the convenience brought by the network, they are also faced with various attacks and threats: confidential leakage, data loss, network abuse, identity fraud, illegal intrusion and other data show that my country's 63.6% of enterprise users are at the "high risk" level, and the annual economic losses caused by network leaks are as high as tens of billions. [0003] With the development of computer networks and related technologies, the speed of network attacks is getting faster, the scale is getting bigger and the degree of automation is getting higher and higher, such as worms, DDos attacks, botnets, etc. have brought about the normal use of the network. a great threat. [0004] At present, the attack detec...

AI Technical Summary

Problems solved by technology

However, these methods are usually independently developed based on different security requirements and goals, and are mostly limited to a single host or network architecture, lack of interoperability between systems, and are obviously insufficient for large-scale network attack detection capabilities.

Images