Network attack behavior detection method and device

Abstract

The invention provides a network attack behavior detection method. The method comprises the following steps: firstly, acquiring domain name system resolution data; secondly, performing data mining on the domain name system resolution data by a preset data mining algorithm to obtain a data mining result; and lastly, detecting network attack behaviors according to the data mining result. Compared with the conventional way of detecting the network attack behaviors by packet capturing analysis, the method has the advantages that the domain name system resolution data are taken as a processing object, and data mining is performed on the domain name system resolution data, so that the network attack behaviors can be detected more efficiently and accurately according to the mining result.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network attack behavior detection method and device. Background technique [0002] With the development of Internet technology, various network security problems emerge in an endless stream, such as Trojan horses, phishing websites, phishing emails, DDoS (DDoS: Distributed Denial of Service, distributed denial of service attack) against domain name servers, and DDoS against specific types of networks. Attacks, large-scale DNS (Domain Name System, Domain Name System) spoofing attacks, botnets and other network attacks seriously threaten the information and data security of network users. Because the above-mentioned network attacks are often highly deceptive and disguised, conventional The detection method of capturing and analyzing all data has low efficiency and low accuracy, making it difficult to effectively detect it. Contents of the invention [0003] Aiming at ...

AI Technical Summary

Problems solved by technology

[0002] With the development of Internet technology, various network security problems emerge in an endless stream, such as Trojan horses, phishing websites, phishing emails, DDoS (DDoS: Distributed Denial of Service, distributed denial of service attack) against domain name servers, and DDoS against specific types of networks. Attacks, large-scale DNS (Domain Name System, Domain Name System) spoofing attacks, botnets and other network attacks seriously threaten the information and data security of network users. Because the above-mentioned network attacks are often highly deceptive and disguised, conventional The detection method of capturing and analyzing all data has low efficiency and low accuracy, making it difficult to detect effectively

Images