Network attack detection method and device

Abstract

The invention provides a network attack detection method and device. The method comprises the following steps: according to a preset keyword set, a feature module carries out keyword matching on a network session sample, so that features of the network session sample are obtained; a tagging module carries out part-of-speech tagging on the features of the network session sample in a hidden state through a pre-trained hidden Markov model, so that an analysis function is achieved; and a processing module inputs the network session sample, which has undergone the part-of-speech tagging, into a pre-trained classification model for classified processing, so that whether a network attack exists in the network session sample or not is determined. The method and device provided by the invention has the advantages that manual protocol analysis is not needed, so that the technical problems in the prior art that feature extraction from sample data needs to rely on artificial experience and the analysis efficiency is low are solved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a network attack detection method and device. Background technique [0002] In the development of Internet technology, network attack is a major problem affecting Internet security. Traditional intrusion detection systems usually use manual coding to generate decision rules. This traditional method has a relatively low false positive rate, but it cannot complete the detection task of detecting this new type of attack when network attacks become more and more complex. [0003] Therefore, in the prior art, machine learning is used to identify whether it is an attack, and machine learning can even be used to perform multi-classification of attack types. However, in the process of machine learning, it is necessary to extract features from the sample data, that is, the step of analysis, and then the classification step of machine learning can be performed according to th...

AI Technical Summary

Problems solved by technology

[0005] For this reason, the first purpose of the present invention is to propose a network attack detection method to solve the problem of extracting features from sample data in the prior art, which not only needs to rely on manual experience, but also takes time and effort and has low analysis efficiency. technical problem

Images