Network security protection method, device and storage medium

Abstract

The embodiment of the invention discloses a network security protection method, a device and storage medium. Various attacks can be effectively intercepted, and the risk that a business system is attacked is relieved. The method disclosed by the embodiment of the invention comprises the following steps: detecting network traffic entering a host, and determining whether an attack behavior is existent by querying an attack behavior feature base; if the attack behavior is existent, generating a virtual honeypot with a corresponding loophole according to the attack behavior, and importing the network traffic into the virtual honeypot; analyzing the network traffic in the virtual honeypot to acquire the attack feature of the novel attack behavior; writing the novel attack behavior containing the attack feature in the attack behavior feature base; if the network traffic is unreceived within the preset time, destroying the virtual honeypot.

Description

Technical field [0001] The present invention relates to network security technology, in particular to a network security protection method, device and storage medium. Background technique [0002] With the development and popularization of computer networks, various illegal network attacks such as hackers and worms on the network are becoming more and more rampant. In order to protect computer networks and systems, various security protection systems have emerged. At present, the security protection of the host mainly depends on the terminal security protection system, such as anti-virus software, etc. However, although the traditional terminal security protection system has a certain effect on the detection and removal of malicious code, it is aimed at password guessing and exploiting. The detection and protection of malicious attack behaviors are not effective. As time goes by, it is difficult to adapt to the constantly changing network attack situation. Therefore, it is neces...

AI Technical Summary

Problems solved by technology

At present, the security protection of the host mainly depends on the terminal security protection system, such as anti-virus software. Malicious attack behavior detection and protection effect is average

With the passage of time, it is difficult to adapt to the constantly changing network attack situation, so it is necessary to carry out technical transformation of the traditional terminal security protection system to adapt to the new network security requirements

[0003] Usually, firewalls, intrusion detection systems, and intrusion prevention systems are deployed at the network egress to discover and block malicious attacks by formulating relevant security policies. , The open services are different, resulting in a general security strategy that cannot effectively defend against specific attacks

Images