Network session statistical characteristic based large-scale network scanning detection method

Abstract

The invention provides a network session statistical characteristic based large-scale network scanning detection method, and belongs to the technical field of internet security. The network session statistical characteristic based large-scale network scanning detection method comprises the steps of screening and classifying captured original network data according to protocol types; then restoring each session in the data and clustering the sessions according to source IPs; counting the number of abnormal returned value of all sessions of each IP, calculating a ratio of the number of the abnormal returned values to the number of normal returned values; analyzing request modes of all sessions of each IP, observing whether the request modes corresponding to the abnormal returned values are accordant; judging whether an attack behavior exists based on the ratio and the request modes; and when the attack behavior exists, obtaining IP information of an attacker and an attacked target, and correspondingly performing processing measures. The network session statistical characteristic based large-scale network scanning detection method is very high in practical feasibility and universal, can identify the scanning condition of any IP made by the attacker, and has a chance to detect an unknown attacking way.

Description

technical field [0001] The invention belongs to the technical field of Internet security, and specifically refers to a large-scale network scanning detection method based on network session statistical characteristics. Background technique [0002] With the continuous development of the Internet and the popularization of computer technology, the global economy is growing faster and faster, and people's lives are becoming more and more convenient, but at the same time it also brings various network security problems and hidden dangers. The development of Internet technology has increased the risks and opportunities of cyber attacks, and once a large-scale cyber attack occurs, the consequences will be more serious. How to do a good job in network security defense has been paid more and more attention by people. The ideal way to deal with network attacks is to build a completely secure system, but this requires all users to authenticate themselves and to use various encryption...

AI Technical Summary

Problems solved by technology

Moreover, many existing network attack detection technologies can only detect a specific attack method. For example, the solution proposed in Reference 2 can only detect port scanning, which has certain limitations.

Images