Threat degree ordering method for server attack sources

Abstract

The embodiment of the invention discloses a threat degree ordering method for server attack sources. The threat degree ordering method for server attack sources includes the steps: acquiring the log information generated in an intrusion detection system of a server; according to the log information, dividing the process of attacking the server by each attack source into a plurality of attack phases, counting the attack number of each attack phase, and according to the threat degree weight given by each attack phase, determining the threat degree of each attack source to the server; and at last, according to the threat degree of each attack source to the server, ordering the threat degree. The threat degree ordering method for server attack sources enables the user to visually obtain the attack source having the highest threat degree to the own server to make corresponding defensive measures timely, thus effectively improving the detection efficiency of the invasion detection system.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for sorting threat degrees of server attack sources. Background technique [0002] With the development of Internet technology and the continuous improvement of social informatization, the network has gradually become an indispensable part of people's production and life, and network security has received more and more attention. Various security products are used in Detect the threat of attack in the network and maintain the safe operation of the network. However, these security methods can only play a specific role within a certain range. They lack effective data fusion and collaborative management mechanisms. Security managers are unable to respond to these threats of network attacks in a timely manner. For the purpose of grasping the threats of network attacks as a whole and maintaining network security operations, the network threat situatio...

AI Technical Summary

Problems solved by technology

[0004] Traditional intrusion detection systems show users the attacks that occur in the network in the form of logs. This form of rough granularity prevents users from focusing on real threatening attack sources and cannot provide network administrators with direct decision-making information.

Images