Network threat detection system and detection method

Abstract

The invention relates to a network threat detection system and detection method. The detection system comprises a network data acquisition module, a feature extraction module, a traffic analysis module, a network threat confirmation module and a threat situation generating module, wherein the network data acquisition module is used for acquiring network traffic data in real time; the feature extraction module is used for acquiring feature information of network traffic data; the traffic analysis module is used for performing feature matching on the network traffic data according to the feature information to obtain suspected network threat events; the network threat confirmation module is used for performing depth detection on the suspected network threat events by using a test statement to obtain real network threat events really having network threats, wherein a depth analysis knowledge base stores multiple threat models with corresponding detection rules; and the threat situation generating module is used for performing big data analysis and data mining on the suspected network threat events and the real network threat events to obtain a correlation of the multiple real network threat events or the occurrence frequency of a certain real network threat event, thereby forming a threat situation. Compared with the prior art, the system and the method have the advantages of high network threat detection rate, low false alarm rate and the like.

Description

Technical field [0001] The present invention relates to the technical field of network security, in particular to a network threat detection system and detection method. Background technique [0002] With the continuous development and application of modern networks, especially the Internet, the network has become a part of people's lives and work. At the same time, cyber threats from all levels are increasing day by day and emerge in endlessly. How to find and detect network threats to ensure network security is in front of every network user, especially network operation and maintenance personnel. [0003] At present, one type of network threat detection and detection is passive monitoring, mainly IDS, IPS and firewall. IDS, IPS, and firewalls mainly passively detect traffic, generate massive amounts of information, and have many false positives. In addition, the security threats provided by the system cannot be accurately located or restored by the operation and maintenance pe...

AI Technical Summary

Problems solved by technology

However, active scanning technology cannot perceive the current network threat status in time, and cannot detect network security threats in the current environment in the first place

Images