Attack detection method and device

Abstract

The embodiments of the invention disclose an attack detection method and device; the method comprises the following steps: firstly, acquiring a target request message; extracting a to-be-detected field from the target request message; then, judging whether a firewall rule matched with the to-be-detected field exists in a blacklist rule base based on a pattern matching algorithm; if yes, detectingthe to-be-detected field based on a regular expression and determining whether the target request message is offensive or not; if not, directly judging that the target request message is not offensive. According to the scheme provided by the invention, for a normal legal request message, when attack detection is carried out, the CPU occupancy rate and the system performance consumption of a firewall system can be greatly reduced; moreover, most of the messages received by the firewall system are legal, so according to the embodiments of the invention, the working efficiency of the firewall system can be greatly improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to an attack detection method and device. Background technique [0002] A firewall, also known as a protective wall, is a network security system located between an internal network and an external network, which allows or restricts the transmission of data according to specific rules. The prior art discovers the attack characteristics of aggressive packets through certain fields in the packets, and these fields are called fields to be detected; for packets received by the firewall, when the parameter value of the field to be detected in the packet When it matches any firewall rule in the blacklist rule base, the system judges that the message is malicious, and the system warns, blocks or records the message in the attack log of the system according to the pre-defined method. [0003] At present, in the process of detecting attack characteristics, the firewall first extracts the ...

AI Technical Summary

Problems solved by technology

[0004] In the existing attack detection methods, the regular expression-based rule matching algorithm is a fine-grained rule matching algorithm, that is, the regular expression will make more detailed matching judgments on the fields to be detected, and the system consumes a lot, so the system runs based on regular When the expression rule matching algorithm is used, the CPU (Central Processing Unit) consumption rate of the host where the system is located is high. In addition, because the packets received by the firewall contain a large number of non-aggressive normal packets, the firewall system Regular expression-based rule matching judgment is performed on each message, resulting in low efficiency of the firewall

Images