Abnormality detection system and method based on protocol analysis

Abstract

The invention discloses an abnormality detection system and method based on protocol analysis. The abnormality detection system based on protocol analysis comprises a data capturing module, a data state recording module, a data analysis module and a rule detection module; the data capturing module is used for caching received data and sending the data to the data state recording module; the data state recording module is used for conducting history matching on the received data and selecting a data packet needing to be analyzed and the analysis mode according to the history if matching succeeds; the data analysis module is used for receiving the data packet needing to be analyzed, conducting protocol analysis on the data packet, extracting protocol attribute features and sending the feature data to the rule detection module; and the rule detection module is used for conducting feature data detection and giving an alarm if an abnormality exists. According to the abnormality detection system and method based on protocol analysis, the problems that the recognition precision is influenced if recognition is conducted only through a port number, and the recognition efficiency is influenced if recognition is conducted only through a large number of feature strings can be avoided.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an anomaly detection system and method based on protocol analysis. Background technique [0002] With the rapid development of the IT industry, the structure and software of computers have become extremely large and complex. A large number of abnormal events on the network have become the primary task of solving today's network security problems. Intrusion into other people's computers, abuse of other people's systems, and behavior events that destroy the integrity of other people's data. For the wanton flooding of abnormal events, intrusion detection, as a detection technology for abnormal events, can actively detect malicious intrusion behaviors in the system, as well as internal Identify and respond to unauthorized activities and misuse. [0003] The existing anomaly detection technology is basically based on the protocol analysis technology. Compared with the tradit...

AI Technical Summary

Problems solved by technology

[0004] 1. For an event, it is necessary to extract a large number of features from each data packet involved for analysis. When a large-scale event occurs, there is still a large bottleneck in processing performance;

[0005] 2. Application layer protocol identification Most of the application layer protocol identification is based on port identification, because the new protocol does not register the port number, or the dynamic allocation of the port number, etc., resulting in low accuracy of protocol identification; and the identification method based entirely on the characteristic string affects Recognition efficiency, it is difficult to realize accurate and efficient recognition and processing of application layer protocols

Images