Network malicious data detection method, device and system

Abstract

The invention provides a network malicious data detection method, device and system, and the method comprises the steps: firstly collecting network data, and extracting a data characteristic value in the network data; secondly obtaining the correlation between the data characteristic value and a malicious data characteristic value in a pre-stored malicious characteristic set; and finally carrying out the expansion of the malicious data characteristic set according to the data characteristic value when the correlation between one data characteristic value and the malicious data characteristic value exceeds a preset correlation threshold value. The method can continuously correct and optimize the malicious data characteristic set, achieves the prediction judgment of unknown network threats and the active defense of the network safety, and reduces the false alarm and alarm leakage rates of intrusion detection of network malicious data.

Description

technical field [0001] The invention relates to the technical field of network intrusion detection (NIDS), in particular to a method, device and system for detecting network malicious data. Background technique [0002] NIDS is the abbreviation of Network Intrusion Detection System (Network Intrusion Detection System), which is an important development direction of network security. It uses the most advanced data capture and protocol analysis technology to monitor all original traffic in the network, and conduct The analysis and processing of traffic and protocols, according to the pattern matching with the existing event and behavior feature database, identifies network attack events and provides event response, realizes monitoring, filtering and even blocking of network data, and ensures the security of the network environment. [0003] There are mainly two detection methods adopted by existing network intrusion detection systems: signature-based detection and anomaly-base...

AI Technical Summary

Problems solved by technology

The feature detection method is mainly to match the network data or behavior with the existing malicious data feature database of the system, but this method is easy to cause false positives and negative negatives, and cannot detect unknown intrusions; the anomaly detection method is based on the construction On the basis of the normal characteristics of the network, define the "abnormal" feature quantity and threshold value. Once the threshold value is exceeded, it will be regarded as abnormal and alarmed. If the threshold value is set unreasonably, it will easily lead to false positives and false positives.

Images