Intrusion detection methods, detection rule generation method, device and system

Abstract

The invention discloses an intrusion detection method, an intrusion detection device, a detection rule generation method, a detection rule generation device, an intrusion detection system and another intrusion detection method. The intrusion detection method comprises the steps of: acquiring a network message sent to an external network; and determining that equipment sending the network message is successfully intruded by a file of a specific type if the network message matches an arbitrary rule in a network message detection rule set successfully, wherein rules in the network message detection rule set are pre-generated according to external network address information of the specific type. By adopting the methods, an internal network can be determined to be successfully intruded by the file of the specific type, and the equipment sending the network message can be determined to be victim equipment, thereby facilitating the network security operation and maintenance staff to dispose the victim equipment quickly and effectively, simplifying the complexity of security operation and maintenance of the internal network, and providing guarantee for improving the security of the internal network.

Description

technical field [0001] The present application relates to network security technology, in particular to an intrusion detection method and device. The present application also relates to a detection rule generation method and device, an intrusion detection system, and another intrusion detection method. Background technique [0002] With the development of computer and Internet technology, internal networks with specific boundaries such as enterprise networks, campus networks, and community networks not only realize the interconnection and resource sharing of internal devices, but also access external networks through routers and other devices, for example: access Various resources or services provided by the Internet network. Due to the communication between the internal network and the external network, in order to ensure security, the internal network usually uses network security detection products. [0003] Taking the enterprise network as an example, the current secur...

AI Technical Summary

Problems solved by technology

[0005] The embodiment of the present application provides an intrusion detection method and device to solve the problem that the existing security detection technology cannot confirm the successful intrusion of a specific type of file and confirm the corresponding victim device

Images