Network session statistical characteristic based large-scale network scanning detection method

A statistical feature and network session technology, applied in the field of Internet security, to achieve the effect of automatic detection function, high efficiency, and resource saving

Inactive Publication Date: 2016-10-12
NAT COMP NETWORK & INFORMATION SECURITY MANAGEMENT CENT +1
View PDF6 Cites 19 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

Moreover, many existing network attack detection technologies can only detect a specific attack method. For

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Network session statistical characteristic based large-scale network scanning detection method

Examples

Experimental program
Comparison scheme
Effect test

Example Embodiment

[0026] The present invention will be further described in detail below with reference to the drawings and examples.

[0027] The present invention analyzes and summarizes the behavior characteristics of hackers scanning for different protocols, and locks the focus on the return value and request mode in the flow. Aiming at these two points, a large-scale scanning detection method based on the statistical characteristics of network sessions is proposed. By comparing the definition of the abnormal return value and the request pattern, it is judged whether the traffic conforms to the characteristics of the attack behavior, so as to identify the possible attack behavior. At the same time, the characteristics of network scanning reflected in the request time are added to the detection mechanism to improve the accuracy of the analysis results.

[0028] First, classify the captured original traffic according to the network protocol, and then propose the attack characteristics that confor...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention provides a network session statistical characteristic based large-scale network scanning detection method, and belongs to the technical field of internet security. The network session statistical characteristic based large-scale network scanning detection method comprises the steps of screening and classifying captured original network data according to protocol types; then restoring each session in the data and clustering the sessions according to source IPs; counting the number of abnormal returned value of all sessions of each IP, calculating a ratio of the number of the abnormal returned values to the number of normal returned values; analyzing request modes of all sessions of each IP, observing whether the request modes corresponding to the abnormal returned values are accordant; judging whether an attack behavior exists based on the ratio and the request modes; and when the attack behavior exists, obtaining IP information of an attacker and an attacked target, and correspondingly performing processing measures. The network session statistical characteristic based large-scale network scanning detection method is very high in practical feasibility and universal, can identify the scanning condition of any IP made by the attacker, and has a chance to detect an unknown attacking way.

Description

technical field [0001] The invention belongs to the technical field of Internet security, and specifically refers to a large-scale network scanning detection method based on network session statistical characteristics. Background technique [0002] With the continuous development of the Internet and the popularization of computer technology, the global economy is growing faster and faster, and people's lives are becoming more and more convenient, but at the same time it also brings various network security problems and hidden dangers. The development of Internet technology has increased the risks and opportunities of cyber attacks, and once a large-scale cyber attack occurs, the consequences will be more serious. How to do a good job in network security defense has been paid more and more attention by people. The ideal way to deal with network attacks is to build a completely secure system, but this requires all users to authenticate themselves and to use various encryption...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): H04L29/06
CPCH04L63/1416
Inventor 李应博张伟孙波房婧姜栋蒋卓键武斌李轶夫鲁骁张建松盖伟麟司成祥杜雄杰刘成
Owner NAT COMP NETWORK & INFORMATION SECURITY MANAGEMENT CENT
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap