Message detection method and device, method and device for establishing local threat intelligence database

Abstract

Embodiments of the present invention provide a message detection method and device, and a method and device for establishing a local threat intelligence database. The message detection method is applied to defense equipment, and the message detection method includes: receiving message traffic to be detected, According to the characteristics of the message traffic, determine whether there is target intelligence information matching the characteristics in the local threat intelligence database; wherein, the local threat intelligence database is based on the first application of the defense device through the cloud server The intelligence information sent by the scene identification is established; if it is determined that there is target intelligence information matching the feature in the local threat intelligence database, then according to the target intelligence information, determine the detection result of the message to be detected. Application of the embodiment of the present invention can realize the use of the local threat intelligence database to detect message traffic without frequent connection to the Internet, thereby saving bandwidth resources and improving the working efficiency of defense equipment.

Description

technical field [0001] The invention relates to network management technology in the communication field, in particular to a message detection method and device, and a method and device for establishing a local threat intelligence database. Background technique [0002] With the rapid development of Internet technology, traditional defense solutions based on signatures or regular expressions have been difficult to cope with the increasingly updated network viruses and network attacks. For this reason, threat intelligence technology has emerged. Threat intelligence technology refers to obtaining existing or upcoming threats or dangers by querying threat intelligence databases, and providing solutions to threats or dangers. [0003] Since the threat intelligence database includes massive data, the threat intelligence database is usually stored in cloud storage. In practical applications, because the local defense device needs to search and match information in the threat inte...

AI Technical Summary

Problems solved by technology

In this way, frequently connecting to the Internet will occupy a large amount of bandwidth resources and consume time, affecting the efficiency of defense equipment

Images