Method for detection of address entropy

Abstract

The present invention discloses a method for detection of an address entropy. The current network attack condition is assessed and the attack condition which most should be paid attention to at present according to the mass of logs generated by an intrusion detection device. The method comprises: obtaining a log of an intrusion detection device, and determining whether there is a large-scale network attack event or not through calculation of the distribution conditions of the log source address and the destination address of the intrusion detection device; merging the log of the inversion detection device according to the three parameters consisting of the source address, the destination address and the types of the event, and detecting and reporting an abnormal address and a hotspot event; performing statistics and displaying the communication process of the hotspot event in the assigned time quantum through graphics; and performing association of the output results to give out the comprehensive assessment of the current network attack condition. The system comprises an entropy module unit, a triple module unit, a hotspot event communication display module unit and a comprehensive association analysis module unit.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method for detecting address entropy. Background technique [0002] The rapid development of the Internet has brought great convenience to the dissemination and utilization of information, but at the same time, human society is facing a huge challenge of information security. In order to alleviate the increasingly serious security problems, intrusion detection equipment (IDS: IntrusionDetectionSystem) has been deployed more and more widely. IDS is installed in the protected network segment, and its monitoring network card works in promiscuous mode, analyzes all data packets in the network segment, and performs real-time detection and response to network attack events. At present, IDS generally adopts the misuse detection technology. The detection method is as follows: first, code the identification specific intrusion behavior pattern, establish a misuse pattern library, and...

AI Technical Summary

Problems solved by technology

Due to the large number of alarms and many irrelevant alarms, most of the energy of security management personnel is spent on processing useless information, and it is difficult to understand the security threat status of the system

[0005] 2. Most of the existing intrusion detection equipment detects based on a single data packet, which is reflected in the form of expression. The alarm information of the intrusion detection equipment is an isolated intrusion event

In this way, when large-scale network abnormal behavior occurs, it is difficult to intuitively obtain the characteristics of the abnormal behavior from the alarm information, and it is difficult to evaluate the current network attack situation as a whole