A network coordinated attack storm source detection method and device

Abstract

Preferred embodiments of the present invention provide a network collaborative attack storm source detection method and apparatus. A three-dimensional data model is established for a network attack event set so that a storm time interval is acquired, a neural network model-based estimation and K order moment-based discrete analysis, skewness analysis and kurtosis analysis are performed on the network attack events in the storm time interval, attack events in a periodical behavior relation are excluded, and a final storm source event is acquired. Compared with a traditional dynamic base line-based storm source detection method, the method is characterized by capturing the storm source event more accurately and reasonably, and based on the same feature database, has the advantages of diversified analysis dimensions, deep collaborative analysis of the network attack event, and more intuitive data expression.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a method and device for detecting a network coordinated attack storm source. Background technique [0002] With the development and evolution of network attack technology and tools, network attack methods are constantly developing towards automation, intelligence, and collaboration. Among them, collaborative network attacks have been widely spread in hacker organizations by virtue of their own characteristics of good concealment and high reliability. and apply. [0003] At present, the vast majority of enterprises or institutions have realized the transformation from traditional service models to Internet service models. In the face of multi-field business expansion, a large number of user groups, and a rapidly changing network environment, coordinated attacks are complicated due to their complex collaborative relationships and numerous collaborative nodes. The ...

AI Technical Summary

Problems solved by technology

[0003] At present, the vast majority of enterprises or institutions have realized the transformation from traditional service models to Internet service models. In the face of multi-field business expansion, a large number of user groups, and a rapidly changing network environment, coordinated attacks are complicated due to their complex collaborative relationships and numerous collaborative nodes. Make the traditional detection method based on dynamic baseline control unable to adapt to the existing security operation and maintenance environment

This traditional network coordinated attack storm source detection method has the following defects: the short-term dynamic baseline threshold cannot rule out the correlation of storm point behavior, which may easily lead to misjudgment of storm characteristics; there is no professional technical system for mining storm point of coordinated attack, only the traditional The order of magnitude statistical method; storm point collaborative determination has not yet been realized, only focus on the change trend, lack of final investigation on the cause of the storm itself

Images